feat: complete Phase 1 foundation hardening + three-mode UI design doc

Phase 1a — Gradient Removal:
- Replaced all gradient-button/gradient-card with glass-button/path-option-card
- Removed banned gradient CSS classes

Phase 1b — Security Hardening:
- SecretsManager: AES-256-GCM encryption (core/security)
- electrs_status: credentials from env vars instead of hardcoded
- port_manager: RwLock proper error handling (no unwrap)
- Pinned all 11 :latest manifest images to specific versions
- parmanode converter: pinned inferred image versions

Phase 1c — Code Quality:
- Split rpc.rs (1795 lines) into 6 handler modules (auth, node, container, package, peers)
- Removed sideload code (UI, store, RPC client, 3 doc files)
- Fixed body background flash on logout/refresh
- Replaced 30 TypeScript `any` types with proper types
- Deleted HelloWorld.vue, removed TODO comments
- Added set -euo pipefail to all shell scripts
- Made deploy script verbose with timestamps and elapsed time

Also adds:
- CLAUDE.md project guide
- docs/three-mode-ui-design.md — design spec for Easy/Pro/Chat UI modes
- OnlineStatusPill component

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/parmanode/src/converter.rs

@@ -68,29 +68,29 @@ app:
     
     fn infer_from_script(&self, script_content: &Option<String>) -> Result<(String, String)> {
         let content = script_content.as_deref().unwrap_or("");
-        
+
         // Try to detect Bitcoin Core
         if content.contains("bitcoind") || content.contains("bitcoin-core") {
-            return Ok(("bitcoin-core".to_string(), "bitcoin/bitcoin:latest".to_string()));
+            return Ok(("bitcoin-core".to_string(), "bitcoin/bitcoin:24.0".to_string()));
         }
-        
+
         // Try to detect LND
         if content.contains("lnd") && !content.contains("lightning") {
-            return Ok(("lnd".to_string(), "lightninglabs/lnd:latest".to_string()));
+            return Ok(("lnd".to_string(), "lightninglabs/lnd:v0.18.0".to_string()));
         }
-        
+
         // Try to detect Core Lightning
         if content.contains("clightning") || content.contains("core-lightning") {
-            return Ok(("core-lightning".to_string(), "elementsproject/lightningd:latest".to_string()));
+            return Ok(("core-lightning".to_string(), "elementsproject/lightningd:v23.08.2".to_string()));
         }
-        
+
         // Try to detect Electrs
         if content.contains("electrs") {
-            return Ok(("electrs".to_string(), "romanz/electrs:latest".to_string()));
+            return Ok(("electrs".to_string(), "romanz/electrs:v0.10.0".to_string()));
         }
-        
-        // Default fallback
-        Ok(("parmanode-module".to_string(), "alpine:latest".to_string()))
+
+        // Default fallback — pin Alpine to a specific version
+        Ok(("parmanode-module".to_string(), "alpine:3.19".to_string()))
     }
 }